How do I bucket/cluster my results into a specific (say 4) buckets displayed as columns?

[underground8]

I have search results with a value "creation_time" -- format: 2012-08-22T20:59:51Z

In my search I added:

| eval age = today() - creation_time 

I thought maybe clustering with 'kmeans' would do it, so I tried the following:

| kmeans k=4 age |

But this doesn't yield any results.

Suggestions? My output should be column graph with four of them, with the bucket clustering the different ages across the creation_times.

[melonman]

Is this someting similar to what you wanted?

SOMESEARCH | eval age = now() - _time  | bucket age bins=4 | chart count by age

I think "bucket" command will do the job.